Connect2id server 12.5.2 security update addressing Log4j CVE-2021-45046

The extraordinary attention which Log4j received due to the Log4shell (CVE-2021-44228) vulnerability lead to the discovery of another related, but fortunately somewhat less severe remote code execution exposure in the logging framework. This new issue is described in CVE-2021-45046.

This 12.5.2 release of the Connect2id server ships the Log4j patch for the new CVE, plus several other updates under the hood.

You can find more information in the release notes below.

Download

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 12.5.2: Connect2id-server.zip

SHA-256: 4f254a27ef02dd1f7deffa05f6620b13d8ba00db2871c2c06d0143f4c419e0cd

Connect2id server 12.5.2 WAR package: c2id.war

SHA-256: 544b1259c3040cf970448f59ea0483b815849d94114a3f7e556bf600abe9071d

Multi-tenant edition

Apache Tomcat package with Connect2id server 12.5.2: Connect2id-server-mt.zip

SHA-256: 769fad20d1fda0b80dcd4ebae53f1dff5b0e1b6a9093938bd91898b544f2c01e

Connect2id server 12.5.2 WAR package: c2id-multi-tenant.war

SHA-256: c6882fc8ed2ac88252e95bcf5589a9abffaed3043999504a6a9d1046fff194c7

Questions?

Contact Connect2id support.

Release notes

12.5.2 (2021-12-15)

Resolved issues

• Updates Log4j to 2.16.0 to address a critical vulnerability described in CVE-2021-45046, see https://cve.mitre.org/cgi-bin/cvename.cgi? name=CVE-2021-45046 (issue server/708).

Dependency changes

• Updates Log4j to 2.16.0

• Updates to org.slf4j:slf4j-api:1.7.32

• Updates to com.google.code.gson:gson:2.8.9

• Updates to com.google.crypto.tink:tink:1.6.1

• Updates BouncyCastle to 1.70.

• Updates to com.unboundid:unboundid-ldapsdk:6.0.3